As much as I dislike legal overreach in international matters, I agree: the pictures of Canadian individuals are likely to have been taken in Canada, or to come from Canadian sources or websites. The fact that they may have been shared with a US company (ex: Facebook, LinkedIn) is irrelevant: copyright etc. does not cease to exist when crossing a digital border. Some countries also have extra protections on top of copyright, like use right, certain rights you can't sign away, etc.
Even worse: by being able to correlate that to Canadian individuals (using metadata or facial metrics, etc), the company can't pretend they don't know who these pictures are from, or where they come from: they know damn well, which makes the court requests limited scope even more acceptable.
Also, claiming to be ignorant of Canadian law may not be a good excuse. They should have known, if only to start doing business there.
Let's construct an equivalent: if in ISIS or Afghan territory, a terrorist group had scraped pictures of people living in the EU or US, and known by them to be "enemies of the caliphate" or something equivalent and that's it's totally A-OK within their legal system to publish that on a website say to call for their murder (I must confess my ignorance on these matters but you get the idea), we'd all say "no it's not". This is just the same. What's legal for us to do domestically with domestic pictures of citizens may not be legal to do somewhere else, and importing the pictures to do it domestically doesn't magically make it legal.